CVE-2023-48383: 
Homebrew vulnerability analysis and mitigation

NetVision Information airPASS version 2.9.0.200703 contains a path traversal vulnerability that was discovered and disclosed on January 14, 2024. The vulnerability allows unauthenticated remote attackers to bypass authentication and download arbitrary system files through a specific URL parameter (TWCERT Advisory, NVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high confidentiality impact (TWCERT Advisory).

The vulnerability allows unauthorized access to arbitrary system files on the affected web server, potentially exposing sensitive information and configuration files. The CVSS score indicates high confidentiality impact, though there are no direct impacts on integrity or availability of the system (NVD).

Users are advised to update to airPASS version 2.9.0.231006 which contains fixes for this vulnerability (TWCERT Advisory).